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O ■ Abstract 

<N ; 

^ | A general mathematical framework for quantum key distribution based on the concepts of 

Cj-i 1 quantum channel and Turing machine is suggested. The security for its special case is proved. 

"^h ■ The assumption is that the adversary can perform only individual (in essence, classical) attacks. 

For this case an advantage of quantum key distribution over classical one is shown. 

(N . 

1 Introduction 

In a number of papers several concrete quantum key distribution protocols were suggested, most of 
them are based on the BB84 protocol [1]. Its security is considered, e.g., in [2-7]. Practical realizations 
of quantum key distribution protocols are described, e.g., in [6,8]. However, formal mathematically 
rigorous general approach to quantum key distribution is lacking at present. For recent discussions 
of these problems see [9-11]. 
Q_i! In this paper we suggest a rather general mathematical model of quantum key distribution. We 

also prove the security for its certain special case. The security is proved on the assumption that the 
adversary can perform only individual (in essence, classical) attacks. For this case an advantage of 
^ ( . the quantum key distribution over classical one is shown. 

> : 

;J ■ 2 Notations 

H is a Hilbert space, S(TC) is a convex set of quantum states (density operators) on H. Let Ha 
and Hb be a pair of Hilbert spaces. A channel G from Ha to Hb is an affine map from S(H A ) to 
S{H B ) such that its linear extension has a completely positive conjugate map [12,13]. The sequence 
of channels 

0" :S(HT) ^S(H% n ), fiGN 
is associated with the channel by the formula 

n (pi® ...®p n ) =e(pi)® ...<8>6(p n ), Pi eS{H A ), i = l,...,n. 

If A and B are finite sets, V(A) and V(B) are probability distributions on A and B, then an affine 
map V : V(A) — > V(B) specifies a classical channel. If P e V(A), then J(P, V) denotes the Shannon 
mutual information between input and output of the channel V if P is a distribution on input of 
the channel V. A channel V can be also specified by a mapping of the corresponding random values. 
If X and Y are random values, then I(X; Y) denotes the mutual information between them. By 
V n : V(A n ) — > V(B n ) denote the discrete memoryless channel corresponding to the channel V. An 
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affine map S : V(A) — > S(H) can be specified by a function £ : A — > S(TC). Let p G <S(7Y) be a 
quantum state. Then the von Neumann entropy is defined by the formula 

tf(p) = -Trplogp. 

Let A be a finite set, P G V(A) a distribution, 7i a Hilbert space, £ : „4 — > <S(7i) a function. We 
define 

C(£) = max 

If {M(b)} is a positive operator- valued measure (POVM), i.e., an observable, on H, then the formula 

P(b) = Tr M(b)p, p G S(H) 

specifies an affine map (a channel) from S(H) to V{B). The space of POVM on H taking values on 
B denotes by M(H; B). An observable from 

M(H; Bf n C M(H® n ; B n ) 

we will call a factorized observable on the space H® n taking values on B n . An observable that doesn't 
belong to this class we will call an entangled observable. By 

B A oM(H;A) C M(H; B) 

denote the class of observables of the form 

{F(b)= M («)W?, {M(a)} aeA eM(H;A), 

where / is an element of the set B A of functions from B to A. 
3 General model of quantum key distribution 

In this section a definition of general mathematical model of quantum key distribution is outlined. 
We consider the following problem of key distribution. Two parties, Alice and Bob, want to get a 
pair of keys (one key for Alice and another one for Bob) using communication channels. A realization 
of a certain random value on a finite set /C, or this random value itself is regarded as a key. If Alice's 
and Bob's keys are identical with high probability, and Eve's information about the keys is negligibly 
small, then the problem of key distribution is considered to be solved with some security degree. 

We will model the parties using extended Turing machines, which form the model of classical 
computers interacting with external devices and communicating with each other by classical and 
quantum channels. 

Let (A, Qa,t~a) be a Turing machine describing Alice, where A is an alphabet, Qa is a set of 
states with additional chosen elements, and ta is a transition function. Further, let (A, Qb,t~b) and 
(A, Qe,te) be Turing machines describing Bob and Eve accordingly. 

Definition 1. A system of quantum key distribution is a triple of objects (extended Turing machines) 

(ETM A ,ETM B ,ETM £ ), 

where 

ETM A = (A, Qa,t a ,Pa,U), 
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ETMb = (A, Qb, t b , Pb, {C^nen), 

ETM E = (A, Q E , Te, Pe, {^e ^}«eN, He)- 
Here P A ,P B , Pe are probability distributions on A + = \J£ =1 A, 

oo 
i=l 

4 n) : A + - c M{H B m \A + ), 

fi E :A + ^M E cM(H E ,A + ), 
where H a ,H b ,He are Hilbert spaces, = {9™}; G /, 

Upon the functions £a, £zT\ £e^> A*e are imposed some restrictions. They will be presented in the 
further paper. 

Interaction of the parties by quantum and classical channels is realized by the use of the additional 
chosen elements in Q A , Q B , Q E and the functions introduced above. 

4 Special model of quantum key distribution 

In this paper we will consider only a special case of the described model. 
Definition 2. A system G of quantum key distribution is a family of the following objects: 

g= ^n A ,n B ,n E ^Aq {n) }nmAM^mAMt\&) • (i) 

Here /C is a finite set (a set of keys), Ha,'Hb,'He are Hilbert spaces, 

Q:S{H a )^S{Hb®H e ) 

is a channel. The functions 

q (n) . £ ^ S(HT) 

specify channels Q^ n \ 

a4"' g M(TC B n ; /C), MP C M(HT;}C). 
For any n G N and e Mg' we define the channel 

A„ = (M^ ) ®M^ ) )o0 n °Q (ri) 

with the input alphabet K, and the output alphabet K? . 

Let A^4 denote a random value uniformly distributed on /C (a key). We denote K B and random 
variables taking values on /C and related to K A by the channel A n for some n, i.e., 

(K B ,A^) = A„(X A ). 

The schematic view of the quantum key distribution process is presented on Fig. I. 
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K A Ha *~ H E ^ K B 



H E *• K E 

Fig. 1 

The proposed model is a quantum analogue of the classical key distribution model considered 
in [14], where the following theorem is proved. 

Theorem 1. Let JC,A,B,£ be finite sets, and a pair of channels 

V : V(A) — »• V(B), W :V(A) ^V(S) 

is given. Further, let 

max \I(P, V) - I(P, W)\ > 0. (2) 

P&V(A) 

Then for any a,/3 G (0, 1) and any sufficiently large n G N there exists a channel (a random coder) 

Fa : V{K) -> V(A n ) 

and a function (a decoder) 

f B :B n ^!C 

such that for any function (a decoder) 

f E :£ n ^IC 

we have: 

1) Vi[K A = K B ] > a, 

2) I(K A ; K E )<1- (3, 
where 

K B = f B oV n oF A {K A ), K E = f E oW n oF A (K A ). 
If for any P the condition 

I(P,V)>I(P,W) 

is true, then condition is not only sufficient, but also necessary for existing of Fa and f E with 
the specified properties for sufficiently large n. 

So, condition (j2j) can be considered as a condition of possibility of classical key distribution with 
an arbitrary security degree. A pair of numbers (a, (3) is regarded as a security degree. 
Now we formulate our main theorem. 

Theorem 2. Let us fix H A ,H E ,H E ,Q in the model G of quantum key distribution J2p. For any 
n G N we put 

MP = JC £ oM(H E ;£)® n , 

where S is a finite set. 

Suppose there exist a finite set A and a channel H specified by a function £ : A — > S(H A ) that 
obey the following property: 

c(e B oe)>c 1 (e B oe), (3) 
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where <d B = Tt He <d, <d E = Tt Hb <d, 

C 1 (e E o£)= max I(P,M oQ E oE). 

PeV(A),M£M(H B ;K) 

Then for any a,j3 G (0, 1) and any sufficiently large n G N there exist a channel (a random coder) 

F A : V{K) -> V(A n ) 

and an observable 

M B g M{H% n ;1C) 

such thatVMfl G M.^ the random values K A , K b and K E , where (K B ,K E ) = A n (K A ), obey the 
properties: 

1) Pv[K A = K B ] > a, 

2) I(K A ;K E )<l-(3. 
Here 

A n (K A ) = (M^ ® MP) o 6" o QW, 

Q(n) = E n Q 

Outline of proof. Let us denote 

Cfc(©|°£ (fc) )= max I{P,M oQ k B oE k ), 

PeV(A),M&M{H% k ;K) 

where 

f (*) ; ^ fc _> S{H A ) 

is the function that specifies the memoryless channel S fc corresponding to the channel S, i.e., 

e (fc) («i,--- 5 afc) = f(ai)® ...®f(a*). 

As [13] 

C(6 fl o0= lim ic fe (6|o^)), 

then, in view of @, 

3nC n (<d B o^)>nC 1 (Q E o£). 
Since for any fc, in view of the conditions on the adversary's measurements class, 

max /(P,Moe^o^)) = ^i(e B oO, 

Pev(A k ) 
MeM{H E ;E)® k 

this implies that 

max I(P,MoQ B o^)> max J(P, M o 9^ o (W) 

P£V(A n ) ' PeV(A n ) 

MeM(H^ n ;IC) MeM{H E ;£)® n 

Then, since the adversary can perform only individual measurements with the subsequent classical 
processing, the conditions of Theorem ^ are satisfied. □ 
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5 On advantages of quantum key distribution over classical one 



Thus, it is possible that for a single use of a quantum channel the classical condition (j2J) of key 
distribution is not satisfied, but with multiple repetitions Bob uses the essentially quantum property, 
entangled measurements, in contrast to the adversary Eve, who performs in essence classical attacks 
- factorized measurements. As a result, Bob achieves advantage over Eve and the subsequent key 
distribution according to the classical scheme becomes possible. 

For demonstration of this possibility we give an example of the quantum key distribution system, 
in which at every run of the quantum channel Eve receive the same state as Bob, i.e., there is an ideal 
eavesdropping. However, as a consequence of the effect of entangled measurements applying by Bob 
with the multiple use of the channel, he gets more information than Eve, and the key distribution 
becomes possible. The effect of entangled measurements is caused by the use of nonorthogonal states. 

Example. Let H A = C 2 ® C 2 , H B = U E = C 2 , 6 is an identical map. A = {0, 1}, 

e(o) = (i^ir, 
e(i) = mmr 2 , 

where 

|^),|^)GC 2 , (^)t^O. 
If for P e V(A) the condition P(0) = or P(l) = is satisfied, then 

\/M E eM{H E yS) 

we have 

I(P, M E oO E oZ)= 0, 

so 

max/(P,M E oe E oS) 
p 

is achieved when P(0),P(1) > 0. Then, due to the fact that the operators P(0)£(0) and P(l)£(l) 
don't commute, condition (jSJ) is satisfied. So, by Theorem |21 the key distribution is possible. 

There aren't analogues in classical cryptography for the given effect when the key distribution is 
possible even under conditions of ideal eavesdropping. In this sense one can say about advantages of 
quantum cryptography over classical one. 

This work was partially supported by the Russian Foundation of Basic Research (project 05- 
01-00884), the grant of the President of the Russian Federation (project NSh-1542. 2003.1) and the 
program "Modern problems of theoretical mathematics" of the Mathematical Sciences department 
of the Russian Academy of Sciences. 
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